PHP 8.1 and every older branch are end of life: the PHP project no longer releases fixes for them. PHP 7.4 ended on 28 November 2022, PHP 8.0 on 26 November 2023 and PHP 8.1 on 31 December 2025. PHP 8.2 follows on 31 December 2026. This page lists every date from php.net, then shows what our free PHP check saw on real sites.
Which PHP Versions Are Supported Today?
PHP supports each branch for four years. The first two years are active support. The next two years bring fixes for critical security issues only. After that the branch is end of life. This is the supported versions list as php.net showed it on 22 October 2026.
| Branch | Initial release | Active support until | Security support until |
|---|---|---|---|
| 8.2 | 8 Dec 2022 | 31 Dec 2024 | 31 Dec 2026 |
| 8.3 | 23 Nov 2023 | 31 Dec 2025 | 31 Dec 2027 |
| 8.4 | 21 Nov 2024 | 31 Dec 2026 | 31 Dec 2028 |
| 8.5 | 20 Nov 2025 | 31 Dec 2027 | 31 Dec 2029 |
Only 8.4 and 8.5 are in active support today. PHP 8.2 and 8.3 get security fixes only. The PHP 8.2 end of life date is 31 December 2026, ten weeks from 22 October 2026. A move to 8.2 buys very little time. PHP 8.5 has security support until 31 December 2029.
When Did PHP 7.4, 8.0 and 8.1 Reach End of Life?
php.net keeps a second list of unsupported branches, for branches that are no longer supported. It gives the end of life date and the last release of each branch. It does not repeat the release and active support dates.
| Branch | End of life | Last release |
|---|---|---|
| 8.1 | 31 Dec 2025 | 8.1.34 |
| 8.0 | 26 Nov 2023 | 8.0.30 |
| 7.4 | 28 Nov 2022 | 7.4.33 |
| 7.3 | 6 Dec 2021 | 7.3.33 |
| 7.2 | 30 Nov 2020 | 7.2.34 |
| 7.1 | 1 Dec 2019 | 7.1.33 |
| 7.0 | 10 Jan 2019 | 7.0.33 |
| 5.6 | 31 Dec 2018 | 5.6.40 |
The PHP 5.5 and older lines ended earlier, and php.net lists them too. A last release is not always the last word. In October 2026 the PHP security team published minimal source backports of the PHP2Shell fixes for 7.4, 8.0 and 8.1. It did this to help people who build from source or have no LTS vendor. The project still says PHP 8.1 and older no longer receive updates, as its 21 October advisory states.
Dates last checked against php.net on 22 October 2026.
What Our Free PHP Check Saw
Our free PHP vulnerability check reads the PHP version a site shows and compares it with the fixed releases of the two PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619. Its logs start on 21 October 2026. By 12:22 UTC on 22 October, visitors had run 16,551 checks on 12,565 distinct sites. Known Google and Bing crawler addresses are excluded. For each site we use its last verdict. No domains or addresses are kept in this post.
1,302 sites showed a readable PHP version. At their last check, 867 were on a vulnerable version and 435 were patched. The bar splits those 867 vulnerable sites by PHP line.
- PHP 7.4 174
- PHP 8.3 156
- PHP 8.2 134
- PHP 8.0, 8.1, 8.4, 8.5 231
- PHP 7.0 to 7.3 99
- PHP 5 73
PHP 7.4 came first. Among the sites on a vulnerable version, PHP 7.4 was the most common (174 sites), ahead of 8.3 (156) and 8.2 (134). PHP 5 still showed on 73 sites.
The table gives the counts for each line that appeared among readable versions, next to its support status on php.net.
| PHP line | Vulnerable | Patched | Status on php.net |
|---|---|---|---|
| 8.5 | 65 | 87 | Supported |
| 8.4 | 67 | 112 | Supported |
| 8.3 | 156 | 135 | Supported, security fixes only |
| 8.2 | 134 | 101 | Supported, security fixes only |
| 8.1 | 70 | 0 | End of life |
| 8.0 | 29 | 0 | End of life |
| 7.4 | 174 | 0 | End of life |
| 7.0 to 7.3 | 99 | 0 | End of life |
| 5.2 to 5.6 | 73 | 0 | End of life |
Two readings stand out. First, 445 of the 867 vulnerable sites (51%) ran PHP 8.1 or older. For them the PHP project has no new release. Second, 422 ran 8.2, 8.3, 8.4 or 8.5. Those lines are supported, so a point release fixes them. They had not updated yet at their last check, and the fixes were only a day old.
Read these numbers with care. They come from checks run by visitors, not from a scan of the internet, and the people who choose to check are not a random sample. A site that hides its PHP version is not safe. It simply cannot be judged from outside. Some Linux distributions fix PHP without changing the version number, so a site counted as vulnerable may already be fixed. The check counts every version on 8.1 or older as affected, because no official fix ships for those lines, so none of them can show as patched.
What Can You Do If You Are Stuck on an End of Life Branch?
The only complete fix is to move to a supported branch. Pick one with years left: 8.4 has security support until 31 December 2028 and 8.5 until 31 December 2029. php.net publishes a migration guide for each step, for example from 7.4 to 8.0 and from 8.1 to 8.2. Test each step on a copy of the system before you change the live one.
If you cannot move yet, these options are backed by the sources below:
- Ask your distribution or hosting vendor for backported fixes. PHP says some distributions and LTS vendors provide them for 8.1 and older.
- On Ubuntu, fixes for PHP2Shell on 22.04 come with standard support. For 20.04 and older they need Ubuntu Pro with Expanded Security Maintenance, according to Canonical.
- Build from the PHP security team backports if you compile PHP yourself. They exist for 7.4, 8.0 and 8.1.
- Take the system offline until it is patched. CISA says organizations that cannot update, or still use PHP 8.1 or earlier, should do this for PHP-based systems.
Workarounds can reduce exposure to specific attack paths. PHP says only an update is a complete solution. A version number that looks old may belong to a vendor build that is fixed, so ask the vendor before you rely on it.
To plan the work, list where PHP runs on your internet-facing systems. Our external attack surface management work does this at scale, and the free PHP check gives a first look at one site. Keep a rhythm of patch management so a branch never reaches its end date unnoticed, and track the dates in your vulnerability management process. The first 36 hours of the PHP2Shell wave are in our timeline.